Silicon Heaven (Paraphrased by Jerrold Schiff)

Silicon Heaven (Paraphrased by Jerrold Schiff)

Ever wonder if Computers were like People, would there be a Silicon Heaven when they die?

That’s a theological stretch! Or is it?

There are five main components to a computer, each can be compared to the human body, and each could fail catastrophically.

RAM or random access memory – is like short term memory – or words on the tip of the tongue.

The Hard Drive – is more like long term memory – where you store pictures, documents and emails.

The CPU chip is like the brain and does all the thinking.

The Power Supply is like the blood of the body – without it, there is no movement, no thought.

And the Motherboard – is the body – which ties everything together and keeps communication strong.

What attacks a computer?

Electrical storms, old age, and viruses from outside sources like the internet.

Some parts – whether in us or in a computer, are replaceable.

And viruses, like bad thoughts or deeds, can be stopped or “fixed”.

So, is there a Silicon Heaven?

Maybe, and only if your computer is very very good!

huntbar - btiein (another of my favourite annoying viruses)

huntbar - btiein

Credit to author:
http://forums.spywareinfo.com/lofiversion/index.php/t16485.html

Thanks for submitting your HijackThis log. Since this reply is lengthy, please print it to help you keep track of the steps.

1 -- Please download About:Buster and unzip it to your desktop. Do not run it just yet.

2 -- Then create a permanent folder for HijackThis (such as C:\HJT) and move your copy of the HijackThis.exe file from its current location in the temporary folders into the new folder. (Or, you could simply download a new copy of HijackThis(v1.98) and unzip it into the new folder.) Either way, HJT needs its own folder to ensure that backup files are reliably preserved. Do not run HJT just yet.

3 -- Reboot into Safe Mode (How do I boot into "Safe" mode?).

3 -- Make sure all browser and program windows are closed, then start the About Buster program, hit Ok, Start, and Ok again to start the scan. It will generate a log. Save that logfile for now, as you'll be asked to send it back to us at the end of these instructions.

Now run About Buster again, and save that logfile for us as well.

4 -- Run HijackThis, press Scan, and put a check against the following entries, if they still show up.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ecmob.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://ecmob.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://ecmob.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ecmob.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ecmob.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://ecmob.dll/index.html#37049
R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {CAD07FE9-6CBE-706E-AD3F-ABD30C3C2C92} - C:\WINDOWS\atlwq.dll

O4 - HKLM\..\Run: [ippy.exe] C:\WINDOWS\ippy.exe
O4 - HKLM\..\RunOnce: [atlyt32.exe] C:\WINDOWS\system32\atlyt32.exe
O4 - HKLM\..\RunOnce: [d3ig.exe] C:\WINDOWS\system32\d3ig.exe
O4 - HKLM\..\RunOnce: [netxt.exe] C:\WINDOWS\system32\netxt.exe
O4 - HKLM\..\RunOnce: [apicg.exe] C:\WINDOWS\apicg.exe
O4 - HKLM\..\RunOnce: [wingf32.exe] C:\WINDOWS\wingf32.exe
O4 - HKLM\..\RunOnce: [atlej.exe] C:\WINDOWS\system32\atlej.exe
O4 - HKLM\..\RunOnce: [sdkqu.exe] C:\WINDOWS\system32\sdkqu.exe
O4 - HKLM\..\RunOnce: [addss.exe] C:\WINDOWS\addss.exe
O4 - HKLM\..\RunOnce: [ieun.exe] C:\WINDOWS\ieun.exe
O4 - HKLM\..\RunOnce: [atlir.exe] C:\WINDOWS\atlir.exe
O4 - HKLM\..\RunOnce: [windj32.exe] C:\WINDOWS\system32\windj32.exe
O4 - HKLM\..\RunOnce: [syszt32.exe] C:\WINDOWS\system32\syszt32.exe

Once you have selected all the items for HJT to fix, make sure all browsers and program windows are closed except for HijackThis, and click fix checked.

5 -- Run About Buster a third time, and save that logfile for us too.

Go ahead and check if any of these files still exist, and if they do please delete them:

C:\WINDOWS\addss.exe
C:\WINDOWS\apicg.exe
C:\WINDOWS\atlir.exe
C:\WINDOWS\atlwq.dll
C:\WINDOWS\ieun.exe
C:\WINDOWS\ippy.exe
C:\WINDOWS\system32\atlej.exe
C:\WINDOWS\system32\atlyt32.exe
C:\WINDOWS\system32\d3ig.exe
C:\WINDOWS\system32\netxt.exe
C:\WINDOWS\system32\sdkqu.exe
C:\WINDOWS\system32\syszt32.exe
C:\WINDOWS\system32\windj32.exe
C:\WINDOWS\wingf32.exe

6 -- Reboot back into Normal Mode, and run HijackThis again. Press Scan, and put a check against the following entry.

O4 - HKLM\..\RunOnce: [Winnt32RunOnceWarning] user.exe

Then, make sure all browsers and program windows are closed except for HijackThis, and click "fix checked"

Then, find the file called user.exe on your system (using Start > Search > For Files and Folders) and rename it to "user.old".

7 -- Now let's clean out the common "hide outs" that malware might try to re-install itself from.

Go to Start > Run and enter: cleanmgr. Let it scan your system, then check these three boxes and then press ok to remove: Temporary Files, Temporary Internet Files, Recycle Bin.

Please disable Windows System Restore, then reboot, then re-enable Windows System Restore by following the instructions at: "How to turn off or turn on Windows XP System Restore"

8 -- Finally, after coming up after the reboot in Step #7 run HijackThis to create a new logfile. Repost it here along with the three About Buster logs. If you had any problems with the steps outlined above, please let us know what they were. If we need to take additional steps, your response and the new logfiles will indicate what they may be.

Once your system is cleaned, we’ll close with some general recommendations for avoiding malware infections in the future.

In the meantime, please read: So how did I get infected in the first place?

Definitions: What is a VIRUS a WORM or a TROJAN

Definitions:

Virus: is a self-replicating program which spreads by attaching itself to a host program. Viruses with a malicious payload cause damage to data, software or hardware.

Worm: is a program designed to replicate itself without human action. It disseminates complete copies of itself across computer networks or via email. THe worm itself may be destructive or it may do harm by consuming memory or bandwidth as it spreads, thus causing infected machines to stop responding.

Trojan Horse: is a malicious program wrapped in a benign exterior. Unlike viruses and worms, trojans do not replicate, but they can cause extensive damage to an infected system.

Remember this virus: Belt.ini Belt.inf

Update the definitions.
Run a full system scan and delete all the files detected as Adware.Binet.
Delete the keys that were added to the registry.
Delete Belt.ini and Belt.inf if found.
Delete infected .cab files if necessary.

For specific details on each of these steps, read the following instructions.

CHANGE Norton Anti Virus.
1) options – manual scan – page defaults
2) options – auto protect – page defaults
you will not see any changes ON THE SCREEN – but it does make changes

3. Deleting the keys from the registry
On the Windows taskbar, click Start > Run.
In the Run dialog box, type regedit and then click OK.
In the Register Editor, navigate to and delete the keys:

HKEY_CLASSES_ROOT\CLSID\{000006B1-19B5-414A-849F-2A3C64AE6939}
HKEY_CLASSES_ROOT\TypeLib\{690BCCB4-6B83-4203-AE77-038C116594EC}
HKEY_CLASSES_ROOT\Interface\{4534CD6B-59D6-43FD-864B-06A0D843444A}
HKEY_CLASSES_ROOT\BiDll.BiDllObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BiDll.BiDllObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Browser Helper Objects\{000006B1-19B5-414A-849F-2A3C64AE6939}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
{4534CD6B-59D6-43FD-864B-06A0D843444A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{000006B1-19B5-414A-849F-2A3C64AE6939}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\
{690BCCB4-6B83-4203-AE77-038C116594EC}
Navigate to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:

=
Exit the Registry Editor.
4. Deleting the .ini and .inf files
Search the system for Belt.ini/Susp.ini and Belt.inf/Susp.inf, deleting them if found.

Follow the instructions for your operating system:
Windows 95/98/Me/NT/2000
On the Windows taskbar, click Start > Find or Search > Files or Folders.
Make sure that "Look in" is set to (C:) and that "Include subfolders" is checked.
In the "Named" or "Search for..." box, type, or copy and paste, the file names:

Belt.ini Belt.inf or Susp.ini Susp.inf
Click Find Now or Search Now.
Delete the displayed files.


Windows XP
On the Windows taskbar, click Start > Search.
Click All files and folders.
In the "All or part of the file name" box, type, or copy and paste, the file names:

Belt.ini Belt.inf or Susp.ini Susp.inf
Verify that "Look in" is set to "Local Hard Drives" or to (C:).
Click "More advanced options."
Check "Search system folders."
Check "Search subfolders."
Click Search.
Delete the displayed files.

5. Deleting infected .cab files
If this threat was detected in a .cab file that is in the Windows Temp folder, your Symantec antivirus program may report that it cannot delete it. If this happens, manually delete it.
On the Windows taskbar, click Start > Run.
Type the following and then click OK:

%temp%
Click the Edit menu > Select All.
Press Delete and then click Yes to confirm. If you see a message that Windows cannot delete files, restart the computer and repeat steps 1 to 3. If you still see the message, just select and delete files that have the .cab extensions.

Cyber bullying is NOT just a different form of "spam".

Cyber bullying is NOT just a different form of "spam".
The goal of spam tends to be financial gain (bank accounts, credit cards).
The goal of cyber bullying tends towards individuals or groups deemed "inferior".

The targets make up the difference:
Spam casts a broad net with an audience of just a few individuals gullible enough to give out personal and financial information.
Cyber bullying has a more personal target - usually someone the offender already knows.

The worst part of cyber bullying is that the evidence remains permanent - residing on web sites, on forums, within social programs like face book.
Sadly, the internet is not patrolled. It is next to impossible to find the "owner" of the media and remove the "graffiti".

What can be done?
The administrators of each web site must be held accountable for the content.
They must be accessible and responsible.
There needs to be a method, be it "human approval" or programmable scanning for harmful posting.

And the poster, the offending cyber bully, must be charged. It is a crime. There is damage. And they must be held accountable, no matter what their age.

If nothing else, we all need to be aware of the harm that can be caused by "alphabet crimes".

Jerrold Schiff
http://www.schiffkey.com

Company Wide Computer Clean Up

Company Wide Computer Clean Up - Why buy a new computer when your old computer can use a boost?
http://www.schiffkey.com